Data Processing Agreement & NDPR Compliance

This page describes how Geoflow approaches Nigeria Data Protection Regulation (NDPR) / Nigeria Data Protection Act (NDPA) compliance, and the typical controller–processor relationship when firms use Geoflow to process personal data. It is a public compliance statement and a draft Data Processing Agreement (DPA) outline. Have counsel review and, where needed, execute a signed DPA for enterprise engagements.

1. NDPR registration status

Geoflow is registered and compliant with the Nigeria Data Protection Regulation. We maintain organisational and technical measures intended to protect personal data processed through our platform and to honour data-subject rights under Nigerian data-protection law.

This site displays a Geoflow-branded “NDPR Compliant” badge for trust signalling. It is not an official Nigeria Data Protection Commission (NDPC) seal and must not be mistaken for a government logo.

2. Roles: controller and processor

• Your firm as controller — When you store client details, surveyor records, project metadata, or other personal data in Geoflow for your business purposes, your organisation typically determines the purposes of processing and acts as the data controller.
• Geoflow as processor — Geoflow processes that Customer Data on your documented instructions to provide the platform (hosting, storage, retrieval, support, security, backups).
• Geoflow as controller — For account administration, billing, product analytics (where consented), security logs, and our own marketing or demo pipelines, Geoflow acts as an independent controller. See the Privacy Policy.

3. Categories of personal data processed

• Surveyor KYC and professional verification information.
• User account identifiers and firm membership roles.
• Client names and contact details entered by your team.
• Project, coordinate, and location-related records that may identify individuals or properties in context.
• Support communications and limited technical logs.

4. Processing instructions

Geoflow will process Customer Data only to provide the subscribed services, maintain security, comply with law, and follow your documented instructions (including configuration and support requests). We will not sell Customer Data or use it for unrelated advertising.

5. Security measures

• Encryption of data in transit (TLS).
• Access limited by authentication and role-based permissions within firm workspaces.
• Administrative access to production systems restricted to authorised personnel.
• Monitoring, backups, and operational practices aimed at confidentiality, integrity, and availability.

Further detail: Trust & Security.

6. Sub-processors

We use carefully selected infrastructure and service providers (for example hosting, email, and payment processors) as sub-processors. They are bound to process data only as needed to deliver their services to us and under confidentiality and security obligations appropriate to the risk.

7. Retention and deletion

Customer Data is retained for the life of the account/subscription and as otherwise required for backups, disputes, or legal obligations. Upon written request after termination, or as configured in-product, we will delete or return Customer Data within a reasonable period, except where retention is required by law.

8. Data-subject rights assistance

If a data subject contacts Geoflow about data your firm controls, we will redirect them to you where appropriate, or assist you in responding to access, correction, deletion, and export requests within NDPR/NDPA expectations, subject to identity verification and technical feasibility.

Individuals may contact info@trygeoflow.com to exercise rights for data Geoflow controls directly.

9. International transfers

If Customer Data is processed or backed up outside Nigeria, we take steps intended to ensure an appropriate level of protection consistent with Nigerian data-protection requirements and contractual safeguards with processors.

10. Breach notification

Where a personal data breach affecting Customer Data is confirmed, Geoflow will notify affected firm administrators without undue delay and provide information reasonably available to help you meet your own notification duties.

11. Requesting a signed DPA

Enterprise customers who need a countersigned Data Processing Agreement can contact info@trygeoflow.com or use the Contact form. This public statement does not replace a negotiated contract where one is required.